pwa-auth@3.7.3
Five elements: user-icon, user-drawer, user-login, user-settings, and email-reset. pwa- events, a small API, and --pwa_ theme variables.
AI Security Review
scanned 3d ago · by lpm-firewall-aiThe package automatically initializes Firebase Analytics after Firebase setup and loads the Google tag script. The README mentions account-count events when Analytics is on, but does not explain the automatic initialization or offer a way to disable it, so this is a runtime telemetry concern.
Decision evidence
public snapshot- After Firebase setup, an onReady callback automatically starts Analytics whenever the browser supports it.
- The bundled Analytics code loads a script from www.googletagmanager.com/gtag/js.
- The README mentions account-count events when Analytics is on, but does not describe the automatic startup shown in the runtime code.
- The package is a Firebase authentication UI, and the README describes Firebase app setup as part of its use.
- Account creation and deletion events are logged after those account actions occur.
Source & flagged code
5 flaggedA single source file combines environment access, network access, and code or shell execution; review context before blocking.
source/pwa-auth.jsView on unpkg · L193Browser source reuses an authenticated session to collect identity data and mutate account settings while reporting externally.
source/pwa-auth.jsView on unpkg · L6Findings
Affected versions and remediation
This report applies to pwa-auth@3.7.3.
See all versions of pwa-auth for other recorded verdicts.
- Review the evidence and your use of pwa-auth@3.7.3 before allowing it. Restrict the permissions described in this report.
- Choose an independently verified alternative or release. This report does not establish that other versions are safe.
Evidence last updated: .
Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.